GHSA-jqr7-5h7r-ch8p
Shopware Non-Persistent XSS in the Frontend
GHSA-jqr7-5h7r-ch8p is a medium vulnerability (CVSS 6.1) in shopware/shopware, published May 21, 2024. No source lists public exploit code. Fixed in shopware/shopware 5.3.7.
- Severity
- 6.1 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
5.3.7shopware/shopware +1 more
Description
A non-persistent Cross-Site Scripting (XSS) vulnerability has been identified in the Shopware eCommerce platform within the frontend. This vulnerability may allow an attacker to inject and execute malicious scripts in the context of a victim's web browser.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Affected packages
| Package | Affected | Fixed |
|---|---|---|
shopware/shopwarePackagist | 5.2.0 up to 5.3.7 | 5.3.7 |
shopware/shopwarePackagist | 5.2.0 up to 5.3.7, plus listed versions 5.3.0v5.2.0v5.2.1v5.2.10v5.2.11 Show 27 moreShow lessv5.2.12v5.2.13v5.2.14v5.2.15v5.2.16v5.2.17v5.2.18v5.2.19v5.2.2v5.2.20v5.2.21v5.2.22v5.2.23v5.2.24v5.2.25v5.2.26v5.2.27v5.2.3v5.2.4v5.2.5v5.2.6v5.2.7v5.2.8v5.2.9v5.3.4v5.3.5v5.3.6 | 5.3.7 |
What each source reports
GitHub Advisories Score used
Shopware Non-Persistent XSS in the Frontend
A non-persistent Cross-Site Scripting (XSS) vulnerability has been identified in the Shopware eCommerce platform within the frontend. This vulnerability may allow an attacker to inject and execute malicious scripts in the context of a victim's web browser.
- Record
GHSA-jqr7-5h7r-ch8p- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
Shopware Non-Persistent XSS in the Frontend
A non-persistent Cross-Site Scripting (XSS) vulnerability has been identified in the Shopware eCommerce platform within the frontend. This vulnerability may allow an attacker to inject and execute malicious scripts in the context of a victim's web browser.
- Record
GHSA-jqr7-5h7r-ch8p- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/shopware5/shopware/commit/54461aa651566dc2701b873fe6bd94589604751b
community.shopware.com/_detail_2048.html
docs.shopware.com/en/shopware-5-en/security-updates/security-update-01-2018?category=shopware-5-en/security-updates